5 ms·

H.R.1981, the end of online privacy as we know it.

137 points by SODaniel 15y ago

rio517 15y ago
If they'd just waited a little longer it could have been H.R. 1984.
- SODaniel 15y ago
  Would have been a whole lot more fitting.
- espeed 15y ago
  Sure enough! -- maybe that's what everyone should start calling it anyway :)
  - Vivtek 15y ago
    That is most definitely what everyone should start calling it.
- deleted 15y ago
  [deleted]
deleted 15y ago
[deleted]
alex_c 15y ago
Wait, they actually called it "Protecting Children From Internet Pornographers Act"? I'm speechless.
- pstuart 15y ago
  The main daily newspaper in San Francisco had a front page article trumpeting a "takedown" of a child porn ring. I commented online that this was an advertisement by the government to encourage surrendering our rights to "protect the children". The reaction was pure hate for my posting because it was defending pedophiles (it wasn't). It felt like an angry mob that had nothing but revenge on its mind. This is why the efforts to destroy all privacy will succeed. For the kids. Yeah, that's it.
  - rosser 15y ago
    The thing is, that takedown, an Ars Technica article about which was on the HN front page briefly last night, was accomplished without this heinous legislation. To my mind, that rather puts the lie to the need for such laws.
  - slowpoke 15y ago
    The reaction was pure hate for my posting because it was defending pedophiles (it wasn't). What do you except? It's sad to see that even usually decent and intelligent people devolve into frothing mobsters when you oppose something that's 'for the children', however ridiculous it may be. It becomes especially despicable when you see the content industry essentially stating that child pornography is a fabulous excuse to justify domain seizures, censorship and other completely outrageous measures to protect their failing business model[1]. It's pretty difficult (if not to say dangerous) to hold a position that's in opposition to such measures. Especially, as in my case, when one is of the opinion that it's not child pornography we should be fighting, but child abuse. The former is, for the most parts, a victimless crime (just look at what's consider child pornography today, it's absolutely ridiculous). I would even say that the holy crusade against child pornography obfuscates and hinders the fight against child abuse severely. [1] http://torrentfreak.com/the-copyright-lobby-absolutely-loves-child-pornography-110709/ http://torrentfreak.com/the-copyright-lobby-absolutely-loves...
- bdhe 15y ago
  This isn't the first time: http://en.wikipedia.org/wiki/USA_PATRIOT_Act http://en.wikipedia.org/wiki/USA_PATRIOT_Act
- spoondan 15y ago
  After her efforts to substantively alter the bill (to defang it or at least add oversight) were rejected, Rep. Zoe Lofgren proposed to rename the act to, "Keep Every American's Digital Data for Submission to the Federal Government Without a Warrant Act of 2011." See Amendment 36 at: http://judiciary.house.gov/hearings/mark_07272011.html http://judiciary.house.gov/hearings/mark_07272011.html
  - espeed 15y ago
    That is awesome. I laughed so hard my eyes started watering!
- SODaniel 15y ago
  This practice is actually very common. If you can't tack your legislative piece on to some 'sure bet' bill you just name it something that no person would ever vote against. Got a piece of legislation on drilling for oil in Alaska? Call it the 'Freedom from Terrorism act' and just like that. It's approved. No one reads the entire Bill, so the name is a HUGE part of the process.
  - alex_c 15y ago
    I know it's a fairly common practice, but this is like an overly hyperbolic and exaggerated example you would give when describing the practice. A bit like saying "PATRIOT Act? What's next, the 'Protect our Children from Pornography' Act?" Apparently! The fact that they actually went this far... I don't know whether to laugh or cry.
    - hugh3 15y ago
      I look forward to the VOTE FOR THIS IF YOU LIKE COOKIES ACT of 2012.
      - 18pfsmt 15y ago
        That's actually helpful levity when considering service offerings like this[1]: DRDL interconnects control and data sessions of protocols like FTP. During the identification process DRDL aggregates detailed traffic properties like MIME-type, filename, chat channel and SIP caller ID. This granularity enables you not only to see the Xbox Live traffic, but rather the Xbox Live users who are playing Halo 3. It's not clear whether use of a VPN/SSH would prevent this kind of traffic analysis, but an obfuscation daemon of some kind could surely be written. While it's kind of interesting, I've never researched how networks like Freenet, or WASTE, etc deal with those issues (or, if they even address them at all). [1]http://www.proceranetworks.com/products/drdl-technology.html http://www.proceranetworks.com/products/drdl-technology.html
skymt 15y ago
> Bill H.R.1981 contains legal responsibility for any Internet Service Provider to keep detailed records of "your Internet activity for 12 months, your name, the address where you live, your bank account numbers, your credit card numbers, and any IP-addresses you've been assigned." The quotation marks imply that the quoted text, which the entire remainder of the post is built on, is part of the bill. It's not, as far as I can tell. In fact, there's no requirement that resembles those described in any conceivable way. Assuming the version on the Library of Congress website [0] is current, the only section regarding record-keeping by ISPs requires them to keep track of customer IP address assignments for 18 months: > A provider of an electronic communication service or remote computing service shall retain for a period of at least 18 months the temporarily assigned network addresses the service assigns to each account, unless that address is transmitted by radio communication (as defined in section 3 of the Communications Act of 1934). The only interpretation I can come up with is that the linked post is a deliberate lie. [0]: http://thomas.loc.gov/cgi-bin/query/z?c112:H.R.1981 http://thomas.loc.gov/cgi-bin/query/z?c112:H.R.1981:
- nbpoole 15y ago
  To be clear, the full text of that portion of the legislation says: --- (a) In General- Section 2703 of title 18, United States Code, is amended by adding at the end the following: `(h) Retention of Certain Records- A provider of an electronic communication service or remote computing service shall retain for a period of at least 18 months the temporarily assigned network addresses the service assigns to each account, unless that address is transmitted by radio communication (as defined in section 3 of the Communications Act of 1934).'. (b) Sense of Congress- It is the sense of Congress that records retained pursuant to section 2703(h) of title 18, United States Code, should be stored securely to protect customer privacy and prevent against breaches of the records. --- In other words, it amends the existing language [0] which says (in part): --- A provider of electronic communication service or remote computing service shall disclose to a governmental entity the— (A) name; (B) address; (C) local and long distance telephone connection records, or records of session times and durations; (D) length of service (including start date) and types of service utilized; (E) telephone or instrument number or other subscriber number or identity, including any temporarily assigned network address; and (F) means and source of payment for such service (including any credit card or bank account number), of a subscriber to or customer of such service when the governmental entity uses an administrative subpoena authorized by a Federal or State statute or a Federal or State grand jury or trial subpoena or any means available under paragraph (1). [snip] (f) Requirement To Preserve Evidence.— (1) In general.— A provider of wire or electronic communication services or a remote computing service, upon the request of a governmental entity, shall take all necessary steps to preserve records and other evidence in its possession pending the issuance of a court order or other process. (2) Period of retention.— Records referred to in paragraph (1) shall be retained for a period of 90 days, which shall be extended for an additional 90-day period upon a renewed request by the governmental entity. --- So you're 100% right: the name, address, etc information is ALREADY being preserved. This legislation mandates that records of IP addresses linked to accounts be stored for at least 18 months, whereas before they would have been retained for 90-180 days. --- [0]: http://www.law.cornell.edu/uscode/18/usc_sec_18_00002703----000-.html http://www.law.cornell.edu/uscode/18/usc_sec_18_00002703----...
heyrhett 15y ago
If everyone in the world clicks that "one click petition" to protest the bill, what happens?
forgotAgain 15y ago
For me it's worthwhile to actually read the resolution and the law. It just makes it more real for me rather than a random internet posting. The resolution is here: http://thomas.loc.gov/cgi-bin/query/z?c112:H.R.1981 http://thomas.loc.gov/cgi-bin/query/z?c112:H.R.1981: The resolution modifies the legal code (law) given here: http://www.law.cornell.edu/uscode/18/usc_sec_18_00002703----000-.html http://www.law.cornell.edu/uscode/18/usc_sec_18_00002703----... [Edit] There is a reasonable write-up of the action from an ACLU blog here: http://www.aclu.org/blog/tag/HR%201981 http://www.aclu.org/blog/tag/HR%201981
- anigbrowl 15y ago
  Booooooring. I'd much rather just battle against dystopian strawmen as a cover for my lack of interest in voting or knowledge of civics.
deleted 15y ago
[deleted]
ddw 15y ago
Could an anonymizer such as Tor help get around this?
- wmf 15y ago
  Yes, in the sense that your ISP will still know your IP address (how could they not?) but won't know what you're doing. And the servers that know what you're doing won't know your IP address.
  - pyre 15y ago
    Only if you ignore the possibility of compromised exit nodes.
    - wmf 15y ago
      A compromised exit node also doesn't know your IP address.
TobbenTM 15y ago
This sounds vaguely familiar to the Data Retention Directive, already in place in several european countries. If you ask me, it's bullshit. For the people that would be afraid of getting caught by this, they should know that it takes about 5 seconds to connect to a VPN and then you have bypassed it all together. This means that the innocent will be watched, while the criminals smart enough just bypass it with ease. I live in Norway, and the DRD (Data Retention Directive) will be activated July next year (I think). At that time, I will push all my traffic through a VPN. My 5 cents.
sudonim 15y ago
How does this affect services like Vyprvpn? Are they an "ISP"? Or is that a loophole so as long as you're using a VPN, you're save from government snoops?
razzmataz 15y ago
So, is there any reliable estimate of how much it will cost to implement this kind of records retention?

137 points by SODaniel 15y ago

rio517 15y ago

If they'd just waited a little longer it could have been H.R. 1984.

SODaniel 15y ago
Would have been a whole lot more fitting.
espeed 15y ago
Sure enough! -- maybe that's what everyone should start calling it anyway :)
- Vivtek 15y ago
  That is most definitely what everyone should start calling it.
deleted 15y ago
[deleted]

deleted 15y ago

[deleted]

alex_c 15y ago

Wait, they actually called it "Protecting Children From Internet Pornographers Act"? I'm speechless.

pstuart 15y ago
The main daily newspaper in San Francisco had a front page article trumpeting a "takedown" of a child porn ring. I commented online that this was an advertisement by the government to encourage surrendering our rights to "protect the children". The reaction was pure hate for my posting because it was defending pedophiles (it wasn't). It felt like an angry mob that had nothing but revenge on its mind. This is why the efforts to destroy all privacy will succeed. For the kids. Yeah, that's it.
- rosser 15y ago
  The thing is, that takedown, an Ars Technica article about which was on the HN front page briefly last night, was accomplished without this heinous legislation. To my mind, that rather puts the lie to the need for such laws.
- slowpoke 15y ago
  The reaction was pure hate for my posting because it was defending pedophiles (it wasn't). What do you except? It's sad to see that even usually decent and intelligent people devolve into frothing mobsters when you oppose something that's 'for the children', however ridiculous it may be. It becomes especially despicable when you see the content industry essentially stating that child pornography is a fabulous excuse to justify domain seizures, censorship and other completely outrageous measures to protect their failing business model[1]. It's pretty difficult (if not to say dangerous) to hold a position that's in opposition to such measures. Especially, as in my case, when one is of the opinion that it's not child pornography we should be fighting, but child abuse. The former is, for the most parts, a victimless crime (just look at what's consider child pornography today, it's absolutely ridiculous). I would even say that the holy crusade against child pornography obfuscates and hinders the fight against child abuse severely. [1] http://torrentfreak.com/the-copyright-lobby-absolutely-loves-child-pornography-110709/ http://torrentfreak.com/the-copyright-lobby-absolutely-loves...
bdhe 15y ago
This isn't the first time: http://en.wikipedia.org/wiki/USA_PATRIOT_Act http://en.wikipedia.org/wiki/USA_PATRIOT_Act
spoondan 15y ago
After her efforts to substantively alter the bill (to defang it or at least add oversight) were rejected, Rep. Zoe Lofgren proposed to rename the act to, "Keep Every American's Digital Data for Submission to the Federal Government Without a Warrant Act of 2011." See Amendment 36 at: http://judiciary.house.gov/hearings/mark_07272011.html http://judiciary.house.gov/hearings/mark_07272011.html
- espeed 15y ago
  That is awesome. I laughed so hard my eyes started watering!
SODaniel 15y ago
This practice is actually very common. If you can't tack your legislative piece on to some 'sure bet' bill you just name it something that no person would ever vote against. Got a piece of legislation on drilling for oil in Alaska? Call it the 'Freedom from Terrorism act' and just like that. It's approved. No one reads the entire Bill, so the name is a HUGE part of the process.
- alex_c 15y ago
  I know it's a fairly common practice, but this is like an overly hyperbolic and exaggerated example you would give when describing the practice. A bit like saying "PATRIOT Act? What's next, the 'Protect our Children from Pornography' Act?" Apparently! The fact that they actually went this far... I don't know whether to laugh or cry.
  - hugh3 15y ago
    I look forward to the VOTE FOR THIS IF YOU LIKE COOKIES ACT of 2012.
    - 18pfsmt 15y ago
      That's actually helpful levity when considering service offerings like this[1]: DRDL interconnects control and data sessions of protocols like FTP. During the identification process DRDL aggregates detailed traffic properties like MIME-type, filename, chat channel and SIP caller ID. This granularity enables you not only to see the Xbox Live traffic, but rather the Xbox Live users who are playing Halo 3. It's not clear whether use of a VPN/SSH would prevent this kind of traffic analysis, but an obfuscation daemon of some kind could surely be written. While it's kind of interesting, I've never researched how networks like Freenet, or WASTE, etc deal with those issues (or, if they even address them at all). [1]http://www.proceranetworks.com/products/drdl-technology.html http://www.proceranetworks.com/products/drdl-technology.html

skymt 15y ago

> Bill H.R.1981 contains legal responsibility for any Internet Service Provider to keep detailed records of "your Internet activity for 12 months, your name, the address where you live, your bank account numbers, your credit card numbers, and any IP-addresses you've been assigned." The quotation marks imply that the quoted text, which the entire remainder of the post is built on, is part of the bill. It's not, as far as I can tell. In fact, there's no requirement that resembles those described in any conceivable way. Assuming the version on the Library of Congress website [0] is current, the only section regarding record-keeping by ISPs requires them to keep track of customer IP address assignments for 18 months: > A provider of an electronic communication service or remote computing service shall retain for a period of at least 18 months the temporarily assigned network addresses the service assigns to each account, unless that address is transmitted by radio communication (as defined in section 3 of the Communications Act of 1934). The only interpretation I can come up with is that the linked post is a deliberate lie. [0]: http://thomas.loc.gov/cgi-bin/query/z?c112:H.R.1981 http://thomas.loc.gov/cgi-bin/query/z?c112:H.R.1981:

nbpoole 15y ago
To be clear, the full text of that portion of the legislation says: --- (a) In General- Section 2703 of title 18, United States Code, is amended by adding at the end the following: `(h) Retention of Certain Records- A provider of an electronic communication service or remote computing service shall retain for a period of at least 18 months the temporarily assigned network addresses the service assigns to each account, unless that address is transmitted by radio communication (as defined in section 3 of the Communications Act of 1934).'. (b) Sense of Congress- It is the sense of Congress that records retained pursuant to section 2703(h) of title 18, United States Code, should be stored securely to protect customer privacy and prevent against breaches of the records. --- In other words, it amends the existing language [0] which says (in part): --- A provider of electronic communication service or remote computing service shall disclose to a governmental entity the— (A) name; (B) address; (C) local and long distance telephone connection records, or records of session times and durations; (D) length of service (including start date) and types of service utilized; (E) telephone or instrument number or other subscriber number or identity, including any temporarily assigned network address; and (F) means and source of payment for such service (including any credit card or bank account number), of a subscriber to or customer of such service when the governmental entity uses an administrative subpoena authorized by a Federal or State statute or a Federal or State grand jury or trial subpoena or any means available under paragraph (1). [snip] (f) Requirement To Preserve Evidence.— (1) In general.— A provider of wire or electronic communication services or a remote computing service, upon the request of a governmental entity, shall take all necessary steps to preserve records and other evidence in its possession pending the issuance of a court order or other process. (2) Period of retention.— Records referred to in paragraph (1) shall be retained for a period of 90 days, which shall be extended for an additional 90-day period upon a renewed request by the governmental entity. --- So you're 100% right: the name, address, etc information is ALREADY being preserved. This legislation mandates that records of IP addresses linked to accounts be stored for at least 18 months, whereas before they would have been retained for 90-180 days. --- [0]: http://www.law.cornell.edu/uscode/18/usc_sec_18_00002703----000-.html http://www.law.cornell.edu/uscode/18/usc_sec_18_00002703----...

heyrhett 15y ago

If everyone in the world clicks that "one click petition" to protest the bill, what happens?

forgotAgain 15y ago

For me it's worthwhile to actually read the resolution and the law. It just makes it more real for me rather than a random internet posting. The resolution is here: http://thomas.loc.gov/cgi-bin/query/z?c112:H.R.1981 http://thomas.loc.gov/cgi-bin/query/z?c112:H.R.1981: The resolution modifies the legal code (law) given here: http://www.law.cornell.edu/uscode/18/usc_sec_18_00002703----000-.html http://www.law.cornell.edu/uscode/18/usc_sec_18_00002703----... [Edit] There is a reasonable write-up of the action from an ACLU blog here: http://www.aclu.org/blog/tag/HR%201981 http://www.aclu.org/blog/tag/HR%201981

anigbrowl 15y ago
Booooooring. I'd much rather just battle against dystopian strawmen as a cover for my lack of interest in voting or knowledge of civics.

deleted 15y ago

[deleted]

ddw 15y ago

Could an anonymizer such as Tor help get around this?

wmf 15y ago
Yes, in the sense that your ISP will still know your IP address (how could they not?) but won't know what you're doing. And the servers that know what you're doing won't know your IP address.
- pyre 15y ago
  Only if you ignore the possibility of compromised exit nodes.
  - wmf 15y ago
    A compromised exit node also doesn't know your IP address.

TobbenTM 15y ago

This sounds vaguely familiar to the Data Retention Directive, already in place in several european countries. If you ask me, it's bullshit. For the people that would be afraid of getting caught by this, they should know that it takes about 5 seconds to connect to a VPN and then you have bypassed it all together. This means that the innocent will be watched, while the criminals smart enough just bypass it with ease. I live in Norway, and the DRD (Data Retention Directive) will be activated July next year (I think). At that time, I will push all my traffic through a VPN. My 5 cents.

sudonim 15y ago

How does this affect services like Vyprvpn? Are they an "ISP"? Or is that a loophole so as long as you're using a VPN, you're save from government snoops?

razzmataz 15y ago

So, is there any reliable estimate of how much it will cost to implement this kind of records retention?